Lambda - Kasutaja kaastöö [et]

Malware

2014-09-09T02:43:06Z

Toomasl:

[http://courses.cs.ttu.ee/pages/Malware |ITX8042 Malware 2014]

[http://courses.cs.ttu.ee/pages/Malware |ITX8060 Malware2 2014]

Malware:ITX8060:2011

2012-01-02T14:27:22Z

Toomasl:

== Announcements ==
===[https://docs.google.com/spreadsheet/embeddedform?formkey=dDhndVg0LXRNdFN0SzdDTjJGREtmRmc6MQ Course Review]===

===[https://docs.google.com/spreadsheet/ccc?key=0AgLcblFEXx61dFhOeW5YUmVyN3pqSFFidmtxSVR3REE Lab results and is graded !]===

= LABS/Homework =

===[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]===

===[[ Malware:ITX8060:2011:LAB2 | LAB2 mmc Jar should be done already]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB3 due date 08.12.2011]]===

===[[ Malware:ITX8060:2011:LAB4 | LAB4 due date 14.12.2011]]===

= LECTURES =

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODZmN2hjbWtmcg introduction]

[http://www.honeynet.org/SecurityWorkshops/2011_Paris Some honeynet slides from this location ]

=== 30.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODdoa3puY3Nmbg Revers engineering]

=== 07.12.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yOTRoY2huajJkNA Document reverse engineering]

=== 14.12.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yOTVnMjczeHFkcQ Recap and final presentations.]

Malware:ITX8060:2011

2012-01-02T14:21:09Z

Toomasl:

Malware:ITX8060:2011

2011-12-14T18:12:23Z

Toomasl:

== Announcements ==
===[https://docs.google.com/spreadsheet/embeddedform?formkey=dDhndVg0LXRNdFN0SzdDTjJGREtmRmc6MQ Course Review]===

= LABS/Homework =

===[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]===

===[[ Malware:ITX8060:2011:LAB2 | LAB2 mmc Jar should be done already]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB3 due date 08.12.2011]]===

===[[ Malware:ITX8060:2011:LAB4 | LAB4 due date 14.12.2011]]===

= LECTURES =

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODZmN2hjbWtmcg introduction]

[http://www.honeynet.org/SecurityWorkshops/2011_Paris Some honeynet slides from this location ]

=== 30.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODdoa3puY3Nmbg Revers engineering]

=== 07.12.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yOTRoY2huajJkNA Document reverse engineering]

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011

2011-12-14T00:53:28Z

Toomasl:

== Announcements ==

= LABS/Homework =

===[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]===

===[[ Malware:ITX8060:2011:LAB2 | LAB2 mmc Jar should be done already]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB3 due date 08.12.2011]]===

===[[ Malware:ITX8060:2011:LAB4 | LAB4 due date 14.12.2011]]===

= LECTURES =

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODZmN2hjbWtmcg introduction]

[http://www.honeynet.org/SecurityWorkshops/2011_Paris Some honeynet slides from this location ]

=== 30.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODdoa3puY3Nmbg Revers engineering]

=== 07.12.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yOTRoY2huajJkNA Document reverse engineering]

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011

2011-12-13T02:53:52Z

Toomasl:

== Announcements ==

= LABS/Homework =

===[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]===

===[[ Malware:ITX8060:2011:LAB2 | LAB2 mmc Jar should be done already]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB3 due date 08.12.2011]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB4 due date 14.12.2011]]===

= LECTURES =

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODZmN2hjbWtmcg introduction]

[http://www.honeynet.org/SecurityWorkshops/2011_Paris Some honeynet slides from this location ]

=== 30.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODdoa3puY3Nmbg Revers engineering]

=== 07.12.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yOTRoY2huajJkNA Document reverse engineering]

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011

2011-12-13T02:53:22Z

Toomasl:

== Announcements ==

= LABS/Homework =

===[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]===

===[[ Malware:ITX8060:2011:LAB2 | LAB2 mmc Jar should be done already]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB3 due date 08.12.2011]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB4 due date 14.12.2011]]===

= LECTURES =

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODZmN2hjbWtmcg introduction]

[http://www.honeynet.org/SecurityWorkshops/2011_Paris Some honeynet slides from this location ]

=== 30.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODdoa3puY3Nmbg Revers engineering]

=== 07.12.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yOTRoY2huajJkNA Document reverse engineering]

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011:LAB4

2011-12-10T02:07:29Z

Toomasl:

== Try to understand who ? ==

==== Milestone: 11.14.2011 - 00:00 ====

Work in teams to 7 peopel in team
pleas register teams before 21:00 13.12.2011

Each team who has more than 3 members should be prepared to present his
solution at 14.12.2011

Lets pretend that exploit downloaded Trojan to leak information out of
your environment and you need to understand who is behind that.

* construct as non malicious honey document you can to track where from or who used you document.
* describe process how you built it and your idea behind this tracking
* describe needed infrastructure you need to track this document.

=== Deliverables ===

* Document
* Description of idea behind document and how you made it.
* Description of infrastructure for document tracing

Malware:ITX8060:2011:LAB4

2011-12-07T18:12:10Z

Toomasl:

== Try to understand who ? ==

==== Milestone: 11.14.2011 - 00:00 ====

Lets pretend that exploit downloaded Trojan to leak information out of
your environment and you need to understand who is behind that.

* construct as non malicious honey document you can to track where from or who used you document.
* describe process how you built it and your idea behind this tracking
* describe needed infrastructure you need to track this document.

Malware:ITX8060:2011:LAB4

2011-12-07T18:10:38Z

Toomasl:

Lets pretend that exploit downloaded Trojan to leak information out of
your environment and you need to understand who is behind that.

* construct as non malicious honey document you can to track where from
or who used you document.
* describe process how you built it and your idea behind this tracking
* describe needed infrastructure you need to track this document.

Malware:ITX8060:2011:LAB3

2011-12-06T17:13:40Z

Toomasl: /* Milestone: 11.12.2011 - 00:00 */

== Analyse an malware ==

==== Milestone: 11.12.2011 - 00:00 ====

* Download [https://sim.cert.ee/hw/download.pcap download.pcap]
* Find malware download in this pcap and Extract malware or malwares
* find out where malware was downloaded from
* What malware , malwares changes in system. (drought process of static and or Dynamic analysis)
* C&C Names and address.
* document the process also Where You found hints and how exactly You did it (you need to show Your thought
and communication process - please write a summary of it.)
* Write an intsident raport.

consider [http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

should be sent to course-malware(at)cert.ee Subject should be : "studentnumber".Firstname.Lab3 File mname Sould be "studentnumber".Firstname.Lab3.(txt.odt.pdf....)

Documenting in sensible manner is crucial !

Malware:ITX8060:2011:LAB3

2011-12-06T17:11:49Z

Toomasl: /* Analyse an malware */

== Analyse an malware ==

==== Milestone: 11.12.2011 - 00:00 ====

* Download [https://sim.cert.ee/hw/download.pcap download.pcap]
* Find malware download in this pcap and Extract malware or malwares
* find out where malware was downloded from
* What malware , malwares changes in system.
* C&C Names and aadress.
* document the process also Where You found hints and how exactly You did it (you need to show Your thought
and communication process - please write a summary of it.)
* Write an intsident raport.

consider [http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

should be sent to course-malware(at)cert.ee Subject should be : "studentnumber".Firstname.Lab3 File mname Sould be "studentnumber".Firstname.Lab3.(txt.odt.pdf....)

Documentation is crucial.

Malware:ITX8060:2011:LAB3

2011-11-30T17:14:56Z

Toomasl: /* Milestone: 08.12.2011 - 00:00 */

== Analyse an malware ==

==== Milestone: 08.12.2011 - 00:00 ====

* Download [https://sim.cert.ee/hw/download.pcap download.pcap]
* Find malware download in this pcap and Extract malware or malwares
* find out where malware was downloded from
* What malware , malwares changes in system.
* C&C Names and aadress.
* document the process also Where You found hints and how exactly You did it (you need to show Your thought
and communication process - please write a summary of it.)
* Write an intsident raport.

consider [http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011:LAB3

2011-11-30T16:58:43Z

Toomasl: /* Milestone: 08.12.2011 - 00:00 */

== Analyse an malware ==

==== Milestone: 08.12.2011 - 00:00 ====

* Download [https://sim.cert.ee/hw/download.pcap download.pcap]
* Find malware download in this pcap and Extract malware or malwares
* find out where malware was downloded from
* What malware , malwares changes in system.
* C&C Names and aadress.
* document the process - Where You found hints and how exactly You did it (you need to show Your thought
and communication process - please write a summary of it.)
* Write an intsident raport.

consider [http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011:LAB3

2011-11-30T16:41:58Z

Toomasl: /* Milestone: 08.12.2011 - 00:00 */

== Analyse an malware ==

==== Milestone: 08.12.2011 - 00:00 ====

* Download [https://sim.cert.ee/hw/download.pcap download.pcap]
* Find malware download in this pcap and Extract malware
* find out where malware was downloded from
* What malware changes in system.
* C&C Names and aadress.
* document the process - Where You found hints and how exactly You did it (you need to show Your thought
and communication process - please write a summary of it.)
* Write an intsident raport.

consider [http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011:LAB3

2011-11-30T16:40:52Z

Toomasl:

== Analyse an malware ==

==== Milestone: 08.12.2011 - 00:00 ====

* Download [https://sim.cert.ee/hw/download.pcap download.pcap]
* Find malware download in this pcap and Extract malware
* find out where malware was downloded from
* What malware changes in system.
* C&C Names and aadress.
* document the process
* Write an intsident raport.

consider [http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011

2011-11-30T16:27:09Z

Toomasl: /* LABS/Homework */

== Announcements ==

= LABS/Homework =

===[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]===

===[[ Malware:ITX8060:2011:LAB2 | LAB2 mmc Jar should be done already]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB3 due date 08.12.2011]]===

===[[ Malware:ITX8060:2011:LAB3 | LAB4 due date 14.12.2011]]===

= LECTURES =

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

=== 30.11.2011 ===

=== 07.12.2011 ===

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011

2011-11-30T16:26:27Z

Toomasl: /* LABS/Homework */

== Announcements ==

= LABS/Homework =

===[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]===

===[[ Malware:ITX8060:2011:LAB2 | LAB2 mmc Jar should be done already]]===

== LECTURES ==

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

=== 30.11.2011 ===

=== 07.12.2011 ===

=== 14.12.2011 ===

Recap and final presentations.

Fail:Sdbot05b.jpg

2011-11-30T16:16:07Z

Toomasl: ajutiselt kiusamiseks

ajutiselt kiusamiseks

Malware:ITX8060:2011:LAB2

2011-11-30T15:56:05Z

Toomasl:

=== Just for remainder ===

[[Malware:ITX8042:2011:LAB#2_Lab.2FHome_assignment | original location ]]

Required for those taking Malware 2

* analyze mobile malware file [https://sim.cert.ee/hw/mmc.jar mmc.jar]
* unpack it (hint - use zip on .jar)
* examine .class files using tool available [http://java.decompiler.free.fr/?q=jdgui here ]
* find code sending SMSes using 'sms://' URI
* EXTRA points - calculate short number used in SM.send
* document the process

Malware:ITX8060:2011:LAB1

2011-11-23T20:48:11Z

Toomasl: /* Milestone: 30.11.2011 - 00:00 */

==== Find out what is wrong. ====

==== Milestone: 01.12.2011 - 00:00 ====

should be sent to course-malware(at)cert.ee
Subject should be : "studentnumber".Firstname.Lab1
File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)

If you did it together

Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1

There is 2 "computers" one of them are definitely infected second one i'm not sure about.

images for virtualbox can be downloaded

=====Bittorrent tracker=====

[http://suvaline.net/zyx/rivettracker/torrents/win1.ova.torrent Win1]

[http://suvaline.net/zyx/rivettracker/torrents/win2.ova.torrent Win2]

=====Http download=====

[https://sim.cert.ee/hw/win1.ova Win1]

[https://sim.cert.ee/hw/win2.ova Win2]

===== Assignment =====

Exercise can be done with partner

* Find out what is infecting the machine win1
* Understand which way is the current malware dangerous to "your organisation"
* If possible, do clean win1
* Is win2 clean or it has problems, too?
* If needed, do clean win2

===== Deliverables =====

Questions that answers should be visible !.

*Summary - Your thoughts about the exercise. Please provide a short summary
* Malware that infects machines
- Md5 hash - if it possible and if not, please explain, why.
- Sha256 has -if it possible and if not, then please explain, why.
- A description - in which way that malware is a threat to "You organization"
* Tools You used to find the infection(s)
* Tools You used to clean machine(s)
* Where You found hints and how exactly You did it (you need to show Your thought
and communication process - please write a summary of it.)
* how would you evaluate your partner.

Please consider
[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011

2011-11-23T20:47:32Z

Toomasl:

== Announcements ==

== LABS/Homework ==

[[ Malware:ITX8060:2011:LAB1 | LAB1 due date 01.12.2011 ]]

== LECTURES ==

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

=== 30.11.2011 ===

=== 07.12.2011 ===

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011:LAB1

2011-11-23T16:20:49Z

Toomasl:

==== Find out what is wrong. ====

==== Milestone: 30.11.2011 - 00:00 ====

should be sent to course-malware(at)cert.ee
Subject should be : "studentnumber".Firstname.Lab1
File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)

If you did it together

Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1

There is 2 "computers" one of them are definitely infected second one i'm not sure about.

images for virtualbox can be downloaded

=====Bittorrent tracker=====

[http://suvaline.net/zyx/rivettracker/torrents/win1.ova.torrent Win1]

[http://suvaline.net/zyx/rivettracker/torrents/win2.ova.torrent Win2]

=====Http download=====

[https://sim.cert.ee/hw/win1.ova Win1]

[https://sim.cert.ee/hw/win2.ova Win2]

===== Assignment =====

Exercise can be done with partner

* Find out what is infecting the machine win1
* Understand which way is the current malware dangerous to "your organisation"
* If possible, do clean win1
* Is win2 clean or it has problems, too?
* If needed, do clean win2

===== Deliverables =====

Questions that answers should be visible !.

*Summary - Your thoughts about the exercise. Please provide a short summary
* Malware that infects machines
- Md5 hash - if it possible and if not, please explain, why.
- Sha256 has -if it possible and if not, then please explain, why.
- A description - in which way that malware is a threat to "You organization"
* Tools You used to find the infection(s)
* Tools You used to clean machine(s)
* Where You found hints and how exactly You did it (you need to show Your thought
and communication process - please write a summary of it.)
* how would you evaluate your partner.

Please consider
[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011:LAB1

2011-11-23T16:13:36Z

Toomasl: /* Milestone: 30.11.2011 - 00:00 */

==== Find out what is wrong. ====

==== Milestone: 30.11.2011 - 00:00 ====

should be sent to course-malware(at)cert.ee
Subject should be : "studentnumber".Firstname.Lab1
File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)

If you did it together

Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1

There is 2 "computers" one of them are definitely infected second one i'm not sure about.

images for virtualbox can be downloaded

=====Bittorrent tracker=====

[http://suvaline.net/zyx/rivettracker/torrents/win1.ova.torrent Win1]

[http://suvaline.net/zyx/rivettracker/torrents/win2.ova.torrent Win2]

=====Http download=====

[https://sim.cert.ee/hw/win1.ova Win1]

[https://sim.cert.ee/hw/win2.ova Win2]

===== Assignment =====

Exercise can be done with partner

* Find out what is infecting win1
* Understand what way the current malware(s) are dangerous to "your organisation"
* If possible clean win1
* Is win2 clean or has it problems ?
* If needed clean win2

===== Deliverables =====

Questions that answers should be visible !.

*Summary -Your thought about exercise and sort summary
* Malware that infects machines
- Md5 has -if it possible and if not why
- Sha256 has -if it possible and if not why
- Description how that malware is threat to "You organization"
* Tools You used to find infection
* Tools You used clean machine
* Where You found hints and how You did it (you need to show Your thought
and communication process - write summary of it.)
* how would you grade you partner.

Pleas consider
[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011:LAB1

2011-11-23T16:13:08Z

Toomasl:

==== Find out what is wrong. ====

==== Milestone: 30.11.2011 - 00:00 ====

should be sent to course-malware(at)cert.ee
Subject should be : "studentnumber".Firstname.Lab1
File mname Sould be "studentnumber".Firstname.Lab1.(txt.odt.pdf....)

If you did it together
Subject should be : "studentnumber".Firstname."studentnumber2".Firstname2.Lab1

There is 2 "computers" one of them are definitely infected second one i'm not sure about.

images for virtualbox can be downloaded

=====Bittorrent tracker=====

[http://suvaline.net/zyx/rivettracker/torrents/win1.ova.torrent Win1]

[http://suvaline.net/zyx/rivettracker/torrents/win2.ova.torrent Win2]

=====Http download=====

[https://sim.cert.ee/hw/win1.ova Win1]

[https://sim.cert.ee/hw/win2.ova Win2]

===== Assignment =====

Exercise can be done with partner

* Find out what is infecting win1
* Understand what way the current malware(s) are dangerous to "your organisation"
* If possible clean win1
* Is win2 clean or has it problems ?
* If needed clean win2

===== Deliverables =====

Questions that answers should be visible !.

*Summary -Your thought about exercise and sort summary
* Malware that infects machines
- Md5 has -if it possible and if not why
- Sha256 has -if it possible and if not why
- Description how that malware is threat to "You organization"
* Tools You used to find infection
* Tools You used clean machine
* Where You found hints and how You did it (you need to show Your thought
and communication process - write summary of it.)
* how would you grade you partner.

Pleas consider
[http://zeltser.com/reverse-malware/malware-analysis-report-template.mm malware analysis report reminders ]

Malware:ITX8060:2011

2011-11-23T13:00:11Z

Toomasl:

== Announcements ==

== LABS/Homework ==

== LECTURES ==

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODI0OG04NjlmYw Slides]

=== 09.11.2011 ===
[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODRmNTNqOHhndw start]

[https://sim.cert.ee/hw/mobile_malware.odp Mobile Malware By Sauli Pahlman]

=== 16.11.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yODVnejdxdHZjYg slides]

=== 23.11.2011 ===

=== 30.11.2011 ===

=== 07.12.2011 ===

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011

2011-11-01T00:14:44Z

Toomasl: /* 09.11.2011 */

== Announcements ==

== LABS/Homework ==

== LECTURES ==

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===

=== 09.11.2011 ===

Mobile Malware By Sauli Pahlman ?

=== 16.11.2011 ===

=== 23.11.2011 ===

=== 30.11.2011 ===

=== 07.12.2011 ===

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8060:2011

2011-11-01T00:14:09Z

Toomasl: /* LECTURES */

== Announcements ==

== LABS/Homework ==

== LECTURES ==

=== 26.10.2011 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzlobjdoZGJtZA Slides]

=== 02.11.2011 ===

=== 09.11.2011 ===

Mobile Malware By Sauli Pahman ?

=== 16.11.2011 ===

=== 23.11.2011 ===

=== 30.11.2011 ===

=== 07.12.2011 ===

=== 14.12.2011 ===

Recap and final presentations.

Malware:ITX8042:2011

2011-10-31T23:56:19Z

Toomasl:

== Announcements ==

===[https://docs.google.com/spreadsheet/ccc?key=0AgLcblFEXx61dDhtTS1WSFlrSDVpa0NGN0NWQnNNOWc&hl=en_US#gid=0 LABS Presented ]===

== LABS/Homework ==

==== [[Malware:ITX8042:2011:LAB#1_Lab.2FHome_assignment |LAB/HOMEWORK1 ]] ====

==== [[ Malware:ITX8042:2011:LAB#2_Lab.2FHome_assignment | LAB/HOMEWORK2 Given by Tarmo R. ]] ====

==== [[Malware:ITX8042:2011:LAB#3_Lab.2FHome_assignment |LAB/HOMEWORK 3]] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 4]] ====

== LECTURES ==

In google dock

=== 2011.08.31 First lecture ===

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

=== 2011.09.07 ===

Presented By ANTO V.

=== 2011.09.14 ===

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

=== 2011.09.21 ===

Presented By Tarmo R.

[https://sim.cert.ee/hw/forensics.pdf Presentation ]

=== 2011.09.28 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMjZnbXBteDJoaw&hl Presentation ]

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

=== 2011.10.05 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzFjNTZ0ZHFmeg Presentation]

=== 2011.10.12 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzZncTk1eDJjcg Slides]

[http://www.youtube.com/watch?v=CS01Hmjv1pQ Ralph Lagner presentation short version ]

[http://www.brookings.edu/~/media/Files/events/2011/0920_cyberdeterrence/20110920_cyber_defense.pdf Additional Readin Deterrance in Cyber Space ]

=== 2011.10.19 ===

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yNzhneDZiNmtnYg Conclusion]

Malware:ITX8060:2011

2011-10-31T23:26:07Z

Toomasl:

== Announcements ==

== LABS/Homework ==

== LECTURES ==

Malware:ITX8042:2011

2011-10-20T01:26:48Z

Toomasl:

== Announcements ==

===[https://docs.google.com/spreadsheet/ccc?key=0AgLcblFEXx61dDhtTS1WSFlrSDVpa0NGN0NWQnNNOWc&hl=en_US#gid=0 LABS Presented ]===

== LABS/Homework ==

==== [[Malware:ITX8042:2011:LAB#1_Lab.2FHome_assignment |LAB/HOMEWORK1 ]] ====

==== [[ Malware:ITX8042:2011:LAB#2_Lab.2FHome_assignment | LAB/HOMEWORK2 Given by Tarmo R. ]] ====

==== [[Malware:ITX8042:2011:LAB#3_Lab.2FHome_assignment |LAB/HOMEWORK 3]] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 4]] ====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/forensics.pdf Presentation ]

2011.09.28

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMjZnbXBteDJoaw&hl Presentation ]

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

2011.10.05

2011.10.12

2011.10.19

Malware:ITX8042:2011:LAB

2011-10-06T18:19:05Z

Toomasl:

= Labs =

== 4 Lab/Home assignment ==

==== Is this a malware how yo knew ? and how to analyse ? ====

==== Milestone: 14.10.2011 - 15:00 EET ====

Download a file [https://sim.cert.ee/hw/pahadus.zip pahadus.zip]

'''WARNING FILE CONTAINS LIVE VIRUSES'''

Take from there three files from 90 files

Pick from 90 files 3 files by next algorithm

#sort them by name.
#first use last number of your student code + your birthday-s day
#for second generate random number http://www.random.org/ and only if it does not mach first number use it for choosing the file
#for third use random number generator again and if it does not mach first or second number use it.

==== Tasks that you need to do ====

* Pick you malware
* Run your malware againtst 2 of next online analysis tools

http://www.virustotal.com
http://camas.comodo.com/
http://www.threatexpert.com/submit.aspx

* find additional 2 online analysis tools where to analyze virus

===== Things that should be presented =====

* chosen numbers
* general information about malware
**name
**md5
**sha1
* link to analysis result if it is possible
* link to disinfecting instructions -if not possible explanation why it is not.
* Analysis tools -links
* Your opinion about each analysis tool and comparison results.

== 3 Lab/Home assignment ==

==== Assignment: Who is responsible for that ip and how i connected to that ? ====

==== Milestone: 07.10.2011 - 08:00 ====

Find whom to sent abuse and other information about that ip get ip-s send mail to
course-malware(at)cert.ee

===== Things that should be presented =====

* My externeal ip- where from i try to do this work (you can omit last 8 bytes)
* My ISP
* My ISP AS number and abuse adress*

atleast 3 times (wil send 3 or mo ip-is)
* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.
* Do i need any additional information besides knowing my problem and ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information

== 2 Lab/Home assignment ==

==== Milestone: 26.09.2011 12:00EET ====

Results to tarmo at cert dot ee cc course-malware(at)cert.ee

for Malware2 optional = requiered and for requiered dedline is 15 now

Primary task
• extract disk image of your or your friends thumbdrive / sd ( / cf) card
• analyze disk image
• document the process
• selection of tools and howtos is [http://www.forensics.nl/tools here] and [http://www.forensicswiki.org/ here]

Required for those taking Malware 2 and Bonus for others
• analyze mobile malware file [https://sim.cert.ee/hw/mmc.jar mmc.jar]
• unpack it (hint - use zip on .jar)
• examine .class files using tool available [http://java.decompiler.free.fr/?q=jdgui here ]
• find code sending SMSes using 'sms://' URI
• XTRA points - calculate short number used in SM.send
• document the process

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware(at)cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infected machine ,
* sending spam for 1 000 000 people,

Hints :

Knowing Russian slang for that will be beneficial
and there are other search engines beside google.

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.

Malware:ITX8042:2011:LAB

2011-10-06T18:12:29Z

Toomasl:

= Labs =

== 4 Lab/Home assignment ==

==== Is this a malware how yo knew ? and how to analyse ? ====

==== Milestone: 14.10.2011 - 15:00 EET ====

Download a file [https://sim.cert.ee/hw/pahadus.zip pahadus.zip]

==WARNING FILE CONTAINS LIVE VIRUSES==

Take from there three files from 90 files

Pick from 90 files 3 files by next algorithm

1) sort them by name.

2) first use last number of your student code + your birthday-s day

3) for second generate random number http://www.random.org/ and only if it does not mach first number use it for choosing the file

4)for third use random number generator again and if it does not mach first or second number use it.

==== Tasks that you need to do ====

* Pick you malware
* Run your malware againtst 2 of next online analysis tools

http://www.virustotal.com
http://camas.comodo.com/
http://www.threatexpert.com/submit.aspx

* find additional 2 online analysis tools where to analyze virus

===== Things that should be presented =====

* chosen numbers
* general information about malware
name
md5
sha1
* link to analysis result if it is possible
* link to disinfecting instructions -if not possible explanation why it is not.
* Analysis tools -links
* Your opinion about each analysis tool and comparison results.

== 3 Lab/Home assignment ==

==== Assignment: Who is responsible for that ip and how i connected to that ? ====

==== Milestone: 07.10.2011 - 08:00 ====

Find whom to sent abuse and other information about that ip get ip-s send mail to
course-malware(at)cert.ee

===== Things that should be presented =====

* My externeal ip- where from i try to do this work (you can omit last 8 bytes)
* My ISP
* My ISP AS number and abuse adress*

atleast 3 times (wil send 3 or mo ip-is)
* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.
* Do i need any additional information besides knowing my problem and ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information

== 2 Lab/Home assignment ==

==== Milestone: 26.09.2011 12:00EET ====

Results to tarmo at cert dot ee cc course-malware(at)cert.ee

for Malware2 optional = requiered and for requiered dedline is 15 now

Primary task
• extract disk image of your or your friends thumbdrive / sd ( / cf) card
• analyze disk image
• document the process
• selection of tools and howtos is [http://www.forensics.nl/tools here] and [http://www.forensicswiki.org/ here]

Required for those taking Malware 2 and Bonus for others
• analyze mobile malware file [https://sim.cert.ee/hw/mmc.jar mmc.jar]
• unpack it (hint - use zip on .jar)
• examine .class files using tool available [http://java.decompiler.free.fr/?q=jdgui here ]
• find code sending SMSes using 'sms://' URI
• XTRA points - calculate short number used in SM.send
• document the process

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware(at)cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infected machine ,
* sending spam for 1 000 000 people,

Hints :

Knowing Russian slang for that will be beneficial
and there are other search engines beside google.

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.

Malware:ITX8042:2011:LAB

2011-10-06T15:52:33Z

Toomasl:

= Labs =

== 4 Lab/Home assignment ==

==== Is this a malware how yo knew ? and how to analyse ? ====

==== Milestone: 14.10.2011 - 15:00 EET ====

Download a file [ https://sim.cert.ee/hw/pahadus.zip pahadus.zip ]

==WARNING FILE CONTAINS LIVE VIRUSES==

===== Things that should be presented =====

* My externeal ip- where from i try to do this work (you can omit last 8 bytes)
* My ISP
* My ISP AS number and abuse adress*

atleast 3 times (wil send 3 or mo ip-is)
* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.
* Do i need any additional information besides knowing my problem and ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information

== 3 Lab/Home assignment ==

==== Assignment: Who is responsible for that ip and how i connected to that ? ====

==== Milestone: 07.10.2011 - 08:00 ====

Find whom to sent abuse and other information about that ip get ip-s send mail to
course-malware(at)cert.ee

===== Things that should be presented =====

* My externeal ip- where from i try to do this work (you can omit last 8 bytes)
* My ISP
* My ISP AS number and abuse adress*

atleast 3 times (wil send 3 or mo ip-is)
* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.
* Do i need any additional information besides knowing my problem and ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information

== 2 Lab/Home assignment ==

==== Milestone: 26.09.2011 12:00EET ====

Results to tarmo at cert dot ee cc course-malware(at)cert.ee

for Malware2 optional = requiered and for requiered dedline is 15 now

Primary task
• extract disk image of your or your friends thumbdrive / sd ( / cf) card
• analyze disk image
• document the process
• selection of tools and howtos is [http://www.forensics.nl/tools here] and [http://www.forensicswiki.org/ here]

Required for those taking Malware 2 and Bonus for others
• analyze mobile malware file [https://sim.cert.ee/hw/mmc.jar mmc.jar]
• unpack it (hint - use zip on .jar)
• examine .class files using tool available [http://java.decompiler.free.fr/?q=jdgui here ]
• find code sending SMSes using 'sms://' URI
• XTRA points - calculate short number used in SM.send
• document the process

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware(at)cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infected machine ,
* sending spam for 1 000 000 people,

Hints :

Knowing Russian slang for that will be beneficial
and there are other search engines beside google.

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.

Malware:ITX8042:2011:LAB

2011-10-06T15:44:51Z

Toomasl:

= Labs =

== 3 Lab/Home assignment ==

==== Assignment: Who is responsible for that ip and how i connected to that ? ====

==== Milestone: 07.10.2011 - 08:00 ====

Find whom to sent abuse and other information about that ip get ip-s send mail to
course-malware(at)cert.ee

===== Things that should be presented =====

* My externeal ip- where from i try to do this work (you can omit last 8 bytes)
* My ISP
* My ISP AS number and abuse adress*

atleast 3 times (wil send 3 or mo ip-is)
* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.
* Do i need any additional information besides knowing my problem and ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information

== 2 Lab/Home assignment ==

==== Milestone: 26.09.2011 12:00EET ====

Results to tarmo at cert dot ee cc course-malware(at)cert.ee

for Malware2 optional = requiered and for requiered dedline is 15 now

Primary task
• extract disk image of your or your friends thumbdrive / sd ( / cf) card
• analyze disk image
• document the process
• selection of tools and howtos is [http://www.forensics.nl/tools here] and [http://www.forensicswiki.org/ here]

Required for those taking Malware 2 and Bonus for others
• analyze mobile malware file [https://sim.cert.ee/hw/mmc.jar mmc.jar]
• unpack it (hint - use zip on .jar)
• examine .class files using tool available [http://java.decompiler.free.fr/?q=jdgui here ]
• find code sending SMSes using 'sms://' URI
• XTRA points - calculate short number used in SM.send
• document the process

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware(at)cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infected machine ,
* sending spam for 1 000 000 people,

Hints :

Knowing Russian slang for that will be beneficial
and there are other search engines beside google.

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.

Malware:ITX8042:2011

2011-10-06T15:40:11Z

Toomasl:

== LABS/Homework ==

==== [[Malware:ITX8042:2011:LAB#1_Lab.2FHome_assignment |LAB/HOMEWORK1 ]] ====

==== [[ Malware:ITX8042:2011:LAB#2_Lab.2FHome_assignment | LAB/HOMEWORK2 Given by Tarmo R. ]] ====

==== [[Malware:ITX8042:2011:LAB#3_Lab.2FHome_assignment |LAB/HOMEWORK 3]] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 4]] ====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/forensics.pdf Presentation ]

2011.09.28

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMjZnbXBteDJoaw&hl Presentation ]

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

2011.10.05

2011.10.12

2011.10.19

== Announcements ==

Malware:ITX8042:2011

2011-10-06T15:39:23Z

Toomasl:

== LABS/Homework ==

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1 ]] ====

==== [[ Malware:ITX8042:2011:LAB#2_Lab.2FHome_assignment | LAB/HOMEWORK2 Given by Tarmo R. ]] ====

==== [[Malware:ITX8042:2011:LAB#3_Lab.2FHome_assignment |LAB/HOMEWORK 3]] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 4]] ====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/forensics.pdf Presentation ]

2011.09.28

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMjZnbXBteDJoaw&hl Presentation ]

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

2011.10.05

2011.10.12

2011.10.19

== Announcements ==

Malware:ITX8042:2011

2011-10-06T15:38:34Z

Toomasl:

== LABS/Homework ==

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1 ]] ====

==== [[ Malware:ITX8042:2011:LAB | LAB/HOMEWORK2 Given by Tarmo R. ]] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 3]] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 4]] ====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/forensics.pdf Presentation ]

2011.09.28

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMjZnbXBteDJoaw&hl Presentation ]

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

2011.10.05

2011.10.12

2011.10.19

== Announcements ==

Malware:ITX8042:2011

2011-10-06T15:37:54Z

Toomasl:

== LABS/Homework ==

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1 ]] ====

==== [ Malware:ITX8042:2011:LAB | LAB/HOMEWORK2 Given by Tarmo R. ] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 3]] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 4]] ====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/forensics.pdf Presentation ]

2011.09.28

[https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMjZnbXBteDJoaw&hl Presentation ]

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

2011.10.05

2011.10.12

2011.10.19

== Announcements ==

Malware:ITX8042:2011:LAB

2011-09-29T18:01:38Z

Toomasl:

= Labs =

== 3 Lab/Home assignment ==

==== Assignment: Who is responsible for that ip and how i connected to that ? ====

==== Milestone: 07.10.2011 - 08:00 ====

Find whom to sent abuse and other information about that ip get ip-s send mail to
course-malware(at)cert.ee

===== Things that should be presented =====

* My externeal ip- where from i try to do this work (you can omit last 8 bytes)
* My ISP
* My ISP AS number and abuse adress*

atleast 3 times (wil send 3 or mo ip-is)
* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to.
* Do i need any additional information besides knowing my problem and ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information

== 2 Lab/Home assignment ==

==== Milestone: 26th 2011 12:00EET ====

Results to tarmo at cert dot ee cc course-malware(at)cert.ee

for Malware2 optional = requiered and for requiered dedline is 15 now

[https://sim.cert.ee/hw/ Presentation and home work ]

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware(at)cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infected machine ,
* sending spam for 1 000 000 people,

Hints :

Knowing Russian slang for that will be beneficial
and there are other search engines beside google.

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.

Malware:ITX8042:2011

2011-09-29T17:17:47Z

Toomasl:

== LABS/Homework ==

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1 ]] ====

==== [https://sim.cert.ee/hw/ LAB/HOMEWORK2 Given by Tarmo R. ] ====

==== [[Malware:ITX8042:2011:LAB |LAB/HOMEWORK 3]] ====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/ Presentation and home work ]

2011.09.28

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

== Announcements ==

Malware:ITX8042:2011

2011-09-28T16:02:21Z

Toomasl:

== LABS/Homework ==

====[[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1]]====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/ Presentation and home work ]

2011.09.28

additional reading

https://www.securitysummit.it/upload/file/9%20giugno/09.0611_FELICIANO%20INTINI.pdf

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

== Announcements ==

Malware:ITX8042:2011

2011-09-28T15:59:22Z

Toomasl:

== LABS/Homework ==

====[[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1]]====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/ Presentation and home work ]

2011.09.28

additional reading

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

== Announcements ==

Malware:ITX8042:2011

2011-09-28T15:57:45Z

Toomasl:

== LABS/Homework ==

====[[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1]]====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.

[https://sim.cert.ee/hw/ Presentation and home work ]

2011.09.28

http://nbo.icann.org/meetings/nairobi2010/presentation-mariposa-botnet-takedown-1-08mar10-en.pdf

== Announcements ==

Malware:ITX8042:2011

2011-09-28T15:05:16Z

Toomasl:

Cyber security 2011 second year

2011-09-28T15:01:29Z

Toomasl:

== News ==

Not much information here, but some information for the [http://lambda.ee/index.php/Cyber_security_2011_first_year first year students] may be relevant for you also.

==Malware==
[[ http://www.lambda.ee/index.php/Malware:ITX8042:2011 | Malware I ]]

== Timetable ==
[https://ois.ttu.ee/portal/page?_pageid=35,435155&_dad=portal&_schema=PORTAL&i=2&a=1&q=1&b=1&c=-1&d=-1&e=-1&e_sem=61&g=18432&h=2 Timetable in OIS]

Malware:ITX8042:2011

2011-09-28T14:54:59Z

Toomasl: /* LECTURES */

== LABS/Homework ==

====[[Malware:ITX8042:2011:LAB |LAB/HOMEWORK1]]====

== LECTURES ==

In google dock

2011.08.31 First lecture

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xOTlndnM2d2tkaA&hl

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18xODN6cGJubW5kZg&hl

2011.09.07

Presented By ANTO V.

2011.09.14

https://docs.google.com/present/edit?id=0AQLcblFEXx61ZHpzZ3RkZ18yMThkOGt6YnpuZA&hl

in addition:

http://crypto.stanford.edu/cs155/lectures/worm-botnet.pdf

2011.09.21

Presented By Tarmo R.
||Presentation and home work |https://sim.cert.ee/hw/ |

== Announcements ==

Malware:ITX8042:2011:LAB

2011-09-19T01:34:24Z

Toomasl: /* Milestone: 8.10.2011 - 20:00 */

= Labs =

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware@cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infected machine ,
* sending spam for 1 000 000 people,

Hints :

Knowing Russian slang for that will be beneficial
and there are other search engines beside google.

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.

Malware:ITX8042:2011

2011-09-15T13:18:59Z

Toomasl:

Malware:ITX8042:2011:LAB

2011-09-15T13:10:53Z

Toomasl:

= Labs =

== 1 Lab/Home assignment ==

==== Assignment: Be a Search master and good infiltrator ====

==== Milestone: 8.10.2011 - 20:00 ====

should be sent to course-malware@cert.ee

Find out how much costs
* DDOS ,
* credit card number ,
* infecting the machine,
* sending spam for 1 000 000 people,

===== Things that should be presented =====

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire such thing
* Prices
and what ever other information you find relavent.